December 2003 - cypherpunks-legacy

Can NSA crack PGP?
by Stanton McCandlish 17 Dec '03

17 Dec '03

In a FidoNet debate, it's been charged that PGP is unsafe, and that NSA can crack it. The persons holding this viewpoint espouse the idea that the NSA can crack anything, pretty much, and that anything they could not crack would not be available to the general public, but would have been supressed. Can anyone disprove this notion definitively? I'm looking for an ironclad case that this idea is incorrect. It'd especially be appreciated if anyone with reasonable "credentials" can respond. Even if you do post replies to the list/group, please at least Cc me so I don't miss them. SO, let's take this opportunity at online education, and spread the news that under current technology, PGP is in fact a secure cryptosystem. Thanks, and let the games begin! -- Stanton McCandlish mech(a)eff.org 1:109/1103 EFF Online Activist & SysOp O P E N P L A T F O R M C R Y P T O P O L I C Y O N L I N E R I G H T S N E T W O R K I N G V I R T U A L C U L T U R E I N F O : M E M B E R S H I P @ E F F . O R G

5 5

BlackNet Investigations Needs More Detail (fwd)
by szabo＠netcom.com 17 Dec '03

17 Dec '03

On the Extropians list Tim May has reminded us in his trademark dramatic style about the ability of various unknown malevolent agents to accumulate dossiers based on posts to mailing lists, Usenet news, and contents of "privte" directories on public providers like Netcom, Delphi, etc. Since Stanton McClandish asked about the "NSA can bust PGP rumors" I'll forward my post to Extropians on that thread (slightly edited to elide quoted comment), since a similar concern had been expressed about the trustworthiness of encryption: I find it extremely improbable that the NSA or anybody else can break long RSA keys (eg, those in PGP) as long as the keys are secure (eg on the private machines of trustworthy people). Even if they could break the public keys or gain access to the secret keys, they're quite unlikely to spend TM cycles and engineer time on the outside possibility of gaining evidence for a relatively minor drug violation. Furthermore, there's so much such minor crypto traffic going around now that they would require other good information (eg traffic analysis) prior to attempting to break the codes, to discriminate the potentially important messages from the gigabytes of variously encoded trivia. On the other hand, the local gendarmes in net-heavy areas like Silicon Valley could easily hire a net-savvy investigator to monitor unscrambled groups like extropians, cypherpunks, etc. and even more trivially search back archives of Usenet, to track down networks of drug users, and the like. (For example, the apparent True Name who regularly posts a market report listing street drug prices around the world to alt.drugs!) In the future this will be even easier, and the archives will still be around. The main problem is that many net users aren't using PGP and other powerful privacy tools like anon remailers, because (a) they have "nothing to hide" from the millions of total strangers, many with violent intent, who read the net, (b) the tools are too inconvenient, and (c) lack of cultural development of pseudonymity (this is quite well developed on several BBS nets, though). These problems are being tackled on several fronts. I'm writing a user-freindly Windows GUI for PGP and anon remailers. There's also work going on to integreate PGP into traditional mailers (elm, Eudora, etc.) and the MIME standard. A culture of pseudonymity is starting to spread to the Internet (with glacial slowness, and driving control freaks like Dick Depew and L.Detweiler insane in the process). There's no reason you shouldn't be able to post about your LSD experiences and the like, but make sure you're protecting your privacy with the right tools, for goodness sake. Nick Szabo szabo(a)netcom.com

2 1

Can NSA crack PGP?
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

I'm not exactly sure why you care whether it's easy , hard, or impossible for NSA to crack it. It probably isn't easy; it might be impossible. But, there is one thing that is true about NSA's ability to crack it: they won't give you cause to know whether they can or not. e.g., if they can, and they read some mail of yours that you REALLY don't want them to read, they won't act on that information in such a manner that you can determine that they cracked the code for your message. They couldn't use it on a warrant, & they couldn't testify as to its contents in court. To do so would advertise their capabilities, which is a no-no for them. (they might, of course, use that information to point people in the right direction so they can attribute information to an anonymous tip, but they have to be careful even there) Even now, when it's pretty certain they could crack DES, you won't find them doing it for a law enforcement agency that asks; it gives away too much. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Tech: Truth about Canon Copiers (fwd)
by jazz＠hal.com 17 Dec '03

17 Dec '03

This is interesting. Since most of the change-making machines in laundromats seem to use the side with the dead white guy, I wonder if it would work to use this copy? ----Dave REes (rees(a)cs.bu.edu) Nah, the changers just say "this side up" - the scanner may be looking at the underside of the bill, or at both sides (more probable). Jason

1 0

PGP-okay BBS?
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

A few months ago we discussed Fidonet, securenet, and PGP. How can I find a BBS that allows PGP traffic? Is there an equivalent of the nixpub list for securenet?

1 0

PGP-okay BBS?
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

uunet!pmantis.berkeley.edu!nobody writes: > A few months ago we discussed Fidonet, securenet, and PGP. How can I find a > BBS that allows PGP traffic? Is there an equivalent of the nixpub list for > securenet? (Sorry for posting this to the list, but an E-mail reply wasn't possible.) Look for the following post recently sent to alt.security.pgp; if you can't find it, mail me and I'll mail it to you. > From: jburrows(a)halcyon.com (John Burrows) > Newsgroups: alt.security.pgp > Subject: Re: Crypto-friendly Fido hubs > Message-ID: <2cptlv$pct(a)nwfocus.wa.com> > Date: 22 Nov 1993 00:36:15 -0800 > References: <145314Z21111993(a)anon.penet.fi> > Sender: news(a)nwfocus.wa.com > Organization: "A World of Information at your Fingertips" > Lines: 261 > NNTP-Posting-Host: nwfocus.wa.com -- Greg Broiles greg(a)goldenbear.com Baked, not fried.

1 0

digital voice board at Comdex
by karn＠qualcomm.com 17 Dec '03

17 Dec '03

Last week at Comdex, I happened across Digicom Systems' booth. They're selling a PC board with a programmable DSP chip from Analog Devices that can be programmed to act as a sound card or as any of several dial modems up to V.32bis. AND... it can be programmed with the GSM vocoder algorithm (approx 13 kb/s). The price was reasonable, too...in the $100 range, as I recall. This could be the enabling product for a homebrew secure telephone. The board can't act as a vocoder and modem simultaneously, so you'll need either two boards, or one board plus a conventional modem. But a vocoder that operates within dialup modem rates has been the roadblock so far in a secure telephone. Anyone interested? The address on Digicom Systems' flyer is 188 Topaz St, Milpitas CA 95035. Voice: 800-833-8900. Fax 408-262-1390. Naturally, I have no connection with this company other than as a prospective customer. --Phil

1 0

No Subject
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

reproduced with attributation: >From Electronic Engineering Times, November 22, 1993, issue 773, page 1 and page 78. U.S. weighs Clipper chip alternatives BY GEORGE LEOPOLD Washington - The Clinton adminstration is readying a new encryption policy that could help defuse industry opposition to introduction of the government-developed Clipper chip by embracing commercial technologies as alternatives for network security, according to government and industry sources. A National Security Council panel led by George Tenet, special presidential assistant for intelligence programs, is completing a broad review of government encryption policy with an eye toward employgin the Clipper chip, as well as commercial alternatives, to ensure privacy and security on public networks. Those would include the proposed electronic superhighway, or National Information Infrastructure (NII). Tenent could not be reached for comment on the review's status, but a U.S. official said last week the results of the seven-month National Security Council policy review will be announced soon. The Clipper chip, backed by the National Security Agency and proposed by the Clinton administration in April as a new data-encryption standard, is widely viewed by industry critics as a fait accompli, since the spy agency wants to use it to protect intelligence data. Asked in an interview last Monday whether the policy review sould resutl in modification of the Clipper chip proposal, Michael Nelson, special assistant for information technology in the White House Office of Science and Technology Policy, acknowledged the need to consider other encryption technologies for network security, including software solutions. He also said the government should have sought greater industry participation before proposing the Clipper chip. Industry opposition to the Clipper chip resurfaced at a recent government-industry summit in San Fancisco (see Nov. 8, page 1). During a panel on the NII, Nelson told angry company executives that the Clinton admininistration would no impose Clipper on industry or rule out alternative encryption technologies. "Clipper is not a silver bullet, it's not even a brass bullet," Nelson said. "It's only one approach." He added, "If we don't address these (network security) issues, people won't use the NII." Nelson said last week the National Security Council review was designed to bring industry and Congress into the process of looking for commercial solutions, besides Clipper, to the network-security issue. Industry groups said last week they have contributed to the review, which began shortly after Clipper was proposed. The review is expected to result in a decision on how to implement Clipper. A decision on how to proceed with the Clipper proposal was scheduled for Sept. 1 but was delayed in response to recommendation from a private-sector advisory group to the Commerce Department. Clipper, which scrambles telephone conversations using an encryption algorithm called Skipjack, is at the heart of an administration initiative announced in April on secure telecom networks and wireless communications links. Forced to balance the interests of companies and private citizens with law-enforcement and national-security needs, President Clinton ordered a comprehensive review of U.S. encryption policy adressing: x Privacy, including the need for voice and data encryption to protect proprietary business data. x The ability of federal law-enforcement officials to tap phones and computers. x The employment of modern technology to build the NII, including encryption technolgy needed to protect proprietary information transmitted over the information superhighway. x The need for American companies to build and export high-technology products to boost U.S. competiveness. U.S. companies may offer encryption as a feature of software sold in the United States, but are prohibited from including encryption in commercial software exports. Proponents of decontrolling encrypted software aruge that restrictions are useless because encryption technology is widely available (see Oct. 18, page 18). Acknowledging industry's concerns, the initiative also includes the creation of a key-escrow system to insure the Clipper chip would be used to protect privacy. (A Commerce Department official said last week the government has dropped the Clipper moniker, referring to it instead as the "key-escrow chip", out of concern for possible trademark infringement.) Devices incorporating the chip would have two unique software keys government investigators would need to decode encoded messages. Two key-escrow data banks would be overseen by a pair of independent agencies designated by the Justice Department and the White House. A decision on which agencies will oversee the databases has not been made, Commerce spokeswoman Anne Enright Shepherd siad last Wedesday. According to a White House statement announcing the encryption policy, "We need the Clipper chip and other approaches that can both provide law-abiding citizens the access they need and prevent criminals from using it to hide their illegal activities." Depsite the administration's insistence that Clipper and the rest of the encryption policy are voluntary efforts, many U.S. high-tech companies have opposed it (see June 21, page 28). Instead, they want policy makers to retain the ubiquitous federal Data Encryption Standard (DES) and use other public-key technologies, such as RC-2 and RC-4. DES uses a 56-bit key while Clipper employs an 80-bit key. Clipper "was forced upon [the Clinton administration] before they had the chance to evaluate its impact," Bruce Heiman, a Washington attorney representing the Business Software Alliance, said last Tuesday. "NSA sold them a bill of goods." The policy review means "they relaize that Clipper has problems ... but they don't want to rule it out entirely," Heiman said, adding that industry would accept Clipper as one alternative to network security only if it is a part of a truly voluntary program that includes public-key encryption.

1 0

Re: G.Barnes --Stellar Hypocrite
by gbarnes＠nyx.cs.du.edu 17 Dec '03

17 Dec '03

Surely you mean D.Barnes, Mr/Ms ld231782? I wouldn't normally mention it, but the Subject: line did rather jump out of my mailbox at me! Yours, Gary Barnes

1 0

Clipper again
by Black Unicorn 17 Dec '03

17 Dec '03

According to a White House statement announcing the encryption policy, "We need the Clipper chip and other approaches that can both provide law-abiding citizens the access they need and prevent criminals from using it to hide their illegal activities." Wait, Is this the NEW policy? The one that admits problems with Clipper, or the old one? It's scary that I even have to ASK this question. If it is new, what's the bloody difference? "...and other approaches...." Smells like a tuna processing plant in here. -> that can both provide law-abiding citizens the access they need and prevent criminals from using it to hide their illegal activities. <- Please. Back to the old security v. privacy debate. Get a clue Clinton What's new here? -> Clipper "was forced upon [the Clinton administration] before they had the chance to evaluate its impact," Bruce Heiman, a Washington attorney representing the Business Software Alliance, said last Tuesday. "NSA sold them a bill of goods." <- Isn't Mr. Heiman being a touch kind here? It was all NSA's fault? That doesn't sound like someone with the true interests of the "Business Software Alliance" at heart. Please forgive me if you're here Mr. Heiman. I'd like to know if this quote was properly within context (or did the media distort it?) -> Depsite the administration's insistence that Clipper and the rest of the encryption policy are voluntary efforts, many U.S. high-tech companies have opposed it.... <- Notice how it's never said WHY it was opposed. Just kinda hinted... The appearence of flexability here is an ILLUSION. It's rhetoric. Trash. They haven't changed the policy, just worked it around a little to make it look like they are worried about concerns of industry... Please. This smokescreen trash makes me sick. Clipper, or a similar proposal will show up in basically the same form called "Splitdeck" or "Skimmer" It's not the chip we object to you IDIOT. It's the policy and all the baggage attached to the bullshit goal of balancing "Private interests and law enforcement requirements." These are almost ALWAYS two opposed concepts. Take a basic class on intelligence Clinton and friends. Security | Liberty polar opposites. -uni- Dark

1 0